Repository navigation
feat(policy): support Cedar as an alternate sandbox policy language - #4565
vishwa-raman wants to merge 33 commits into
Conversation
|
All contributors have signed the DCO ✍️ ✅ |
9e11281 to
d9df6d3
Compare
|
I have read the DCO document and I hereby sign the DCO. |
|
/ok to test d9df6d3 |
|
/ok to test dd2c70d |
d9df6d3 to
dd2c70d
Compare
|
🌿 Preview your docs: https://nvidia-preview-pr-4565.docs.buildwithfern.com/openshell |
Compatibility review (advisory)New or updated breaking changes; see the full report for all findings. 1. rust-sdk — No explicit risk acceptance found
2. go-sdk — No explicit risk acceptance foundZero-valued
3. typescript-sdk — No explicit risk acceptance foundRegenerating the exported
Review details
Advisory review; publication gates are unchanged. |
vishwa-raman
added
test:e2e
|
Label |
|
Compatibility risk acceptance for the
These fields are the wire representation of RFC 0020 (#4564) and cannot be deferred without deferring the feature. |
|
/ok to test 55b998e |
dd2c70d to
486f456
Compare
|
/ok to test 486f456 |
Compatibility review (advisory)New or updated breaking changes; see the full report for all findings. 1. rust-sdk — Risk explicitly accepted
2. go-sdk — Risk explicitly acceptedZero-valued
3. typescript-sdk — Risk explicitly acceptedRegenerating the exported
Review details
Advisory review; publication gates are unchanged. |
|
/ok to test 4cdee2a |
486f456 to
4cdee2a
Compare
|
/ok to test 77f4818 |
4cdee2a to
77f4818
Compare
|
@vishwa-raman — aggregated panel review of commit I recommend changes before merge and splitting this PR into four PRs. The panel found six code defects and one required documentation update. I verified and deduplicated these through source and caller tracing; the failure scenarios below were not executed locally.
I recommend this split because the PR combines an existing-engine refactor, a new language implementation, feature activation, and example expansion. Those have different review and rollback boundaries.
PRs 1 and 2 can be reviewed independently; PR 3 depends on both. Keep Cedar acceptance and its complete enforcement path together. Splitting CLI, gateway, and supervisor activation into independently enabled changes would create unsafe intermediate states. Tests needed to establish safe enforcement belong with their implementation. The verification review also identified two limits worth addressing:
The panel comprised independent reviews of Cedar semantics, runtime enforcement, authoring/control-plane integration, and the full parity/example corpus, followed by an independent semantic recheck. No additional concrete filesystem widening, token-grant authorization defect, or YAML regression survived verification. New-gateway/old-supervisor compatibility remains unverified. Reviewed head Local diff and syntax checks passed. At review time, exact-head branch CI had passed Rust tests on Linux/macOS and Go/TypeScript SDK checks; integration CI had passed Cedar and MCP-Cedar E2E. Other runtime jobs were still running at the last review check. Rust/Cargo was unavailable locally, so the new failure scenarios still need executable regression tests. Review status: findings. |
77f4818 to
77d3238
Compare
Bring the branch up to date with main (9a85667), which hosts sandboxes on a shared supervisor and isolates networking state per sandbox instance. Conflict resolution: - openshell-supervisor: the policy poll loop keys on the per-instance `gateway` from main and the `PolicyEngine` from this branch. - openshell-supervisor-network: `run_networking` keeps main's per-instance token-grant resolver and denial log; the OPA import is gone because the engine is reached through `PolicyEngine`. - openshell-server: keep main's rewritten authorization test together with the assertion that `Health` stays callable by ordinary users for Cedar capability discovery. - Cargo.lock: main's rustls-webpki and webpki-roots versions are kept; Cedar's regex requirement is retained. Adapt tests that main added since the merge base: the passthrough relay test selects middleware through `PolicyEngine::passthrough_middleware`, the Cedar mixed-version test builds a `GatewayEndpoint`, and the testkit sandbox configuration fetch advertises Cedar support. Refs #4474 Signed-off-by: Vishwanath Raman <vishwanathr@nvidia.com>
|
/ok to test 1bd37b1 |
Bring the branch up to date with main (c4688aa). The Windows test repairs on main (92434dc) cover the same tests this branch had stabilized, so the conflicts resolve to main's versions: the mutation guard stress test yields until its deadline instead of counting yields, and the startup write-refusal scenarios gate baseline enrichment on Unix with main's wording. The `PolicySource` import that resolution needs is restored. Refs #4474 Signed-off-by: Vishwanath Raman <vishwanathr@nvidia.com>
|
/ok to test 2927646 |
|
I’d like Cedar to be an explicit opt-in feature, enabled in published Release Dev artifacts and excluded from stable releases.
The intended boundary is: clients transport policy documents; providers supply credential rules; drivers launch workloads; the gateway and supervisor own Cedar support. |
Cedar sandbox policies now ship only in builds that enable the gateway and supervisor `cedar` Cargo feature. Release Dev and branch E2E enable it; prerelease and stable builds exclude the Cedar engine. - openshell-policy has no default features. Cedar validation, load warnings, filesystem-grant derivation, and provider-rule conversion live in its gated `cedar` module; clients carry Cedar documents as text. - openshell-supervisor-network gates its Cedar engine behind `cedar`; builds without it use an uninhabited stub that rejects Cedar policies. - The gateway and supervisor derive supports_cedar_policy from the compiled feature. A gateway without Cedar rejects Cedar on create, update, start, and stored-policy reads, and skips such sandboxes in store-wide checks. - The gateway returns policy load warnings (PolicyWarning) from CreateSandbox and sandbox UpdateConfig, including on replay; the CLI prints them and no longer links Cedar. - Compute drivers report driver_enforces_policy, and the gateway rejects Cedar for drivers that enforce policy themselves, such as MXC. - CI lints and tests both configurations, verifies stable dependency graphs exclude Cedar, and release builds fail if a binary embeds a Cedar crate. - The Cedar docs page is published only on the dev docs site. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
Note 🤖 Claude Opus 5.5 responding on behalf of johnnygreco @drew Your Cedar feedback is addressed in 46978de. Please confirm the three interpretations below; nothing else needs a decision. Cedar is now opt-in:
Changes beyond your comment:
|
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Address the review findings on the Cedar policy support. Engine robustness: - Bound policy text before parsing (size, bracket nesting, expression depth) with a non-recursive scan, and run loading and evaluation on a stack sized for those bounds, so no policy within the gateway limit or request the proxy delivers can exhaust a worker stack. - Deny requests whose inspected strings exceed 16 KiB, bounding the delimited `like` recursion. - Decide GraphQL paths by ignoring excluded permits in one evaluation instead of building per-path policy set copies. Analysis: - Bucket and budget host-overlap checks. - Warn on audit paths beside enforced policies of overlapping entries. - Keep staged policies from creating inspection, paths, or protocols, and warn when they would never be evaluated. - Reject forbids that read `destination_ip` without a guard, and policies that read `principal.user` or `principal.group`. Runtime and control plane: - Close open Cedar tunnels when authored middleware configs change. - Reject `tls: skip` endpoint settings on endpoints Cedar inspects, and keep inspecting them when a provider rule sets `tls: skip`. - Report Cedar support in `SupervisorHello` and deliver a not-admitted configuration instead of a Cedar policy to supervisors without it. - Reject incremental policy updates on Cedar sandboxes in the gateway and CLI. - Re-resolve binary aliases when a policy staged before startup commits. - Keep OPA result conversion outside the engine lock and project only consumed fields; document the policy-DNS identity contract. - Test the provider-rule JSON contract end to end. Docs: Cedar limits, `tls: skip`, staged and audit semantics, tested drivers, and the Cedar dependency pin. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Adapt main's suspend and resume support to the Cedar changes: resume applies the start path's Cedar support and driver checks, new SandboxResponse constructions carry policy_warnings, tests match the boxed sandbox subcommand, and the reviewed schema fingerprints cover both sides. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
/ok to test 1265969 |
Compatibility review (advisory)New or updated breaking changes; see the full report for all findings. 1. rust-sdk — No explicit risk acceptance foundSix existing raw::proto message structs gain supports_cedar_policy, policy_warnings, or driver_enforces_policy fields.
2. typescript-sdk — No explicit risk acceptance foundExisting raw messages gain required supportsCedarPolicy or policyWarnings properties, and curated UpdateConfigResult gains required policyWarnings.
3. go-sdk — No explicit risk acceptance foundencoding/json output for ConfigUpdateResult gains PolicyWarnings:null even when an update returns no warnings.
Review details
Advisory review; publication gates are unchanged. |
Engine: - Reject Cedar policies that test which process the principal is. Every request is evaluated as one placeholder process, so such a test never matches, and a forbid written that way never applied. - Deny hosts with an empty DNS label before evaluating policies. Host globs matched them, but inspection did not select them, so glob HttpRequest forbids were skipped. - Bound the work of one request's query-value combinations by the size of the evaluated policy set (16,384 policy evaluations, at most 1,024 combinations). - Summarize CedarEngine in Debug instead of walking every policy's expression tree outside the grown stack. Build and CI: - Reject a second stacker version in cargo-deny; Cedar's stack checks share its thread-local. - Require the Cedar crates in Cedar-enabled gateway and supervisor binaries, a positive control for the stable forbidden-crates check. CLI: print Cedar policy text without YAML highlighting. Docs: `tls: skip` for clients that pin certificates or present client certificates, and the new principal, host, and query limits. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
/ok to test 43b8944 |
Keep the per-policy evaluation budget, which bounds the work of one request for large policy sets, but restore 4,096 combinations as the ceiling RFC 0020 specifies. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
- Compile correlated_endpoint only where it is called: on Linux, and in Cedar-enabled tests. - Expect needless_pass_by_ref_mut on the non-Unix SuspendSignal::recv, which keeps the Unix receiver's signature. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
- Load a Cedar policy once per supervisor startup and reload: validation hands its engine to the Cedar network engine, and startup reads filesystem grants from that engine. - Convert Cedar inspection protocols to proxy protocols with an exhaustive match instead of a string label. - Share path specificity with the relay, endpoint port selection, the endpoint selector match, and the `tls: skip` overlap check between the gateway and supervisor. - Document why Cedar's exact host overlap and core's conservative overlap both exist, and test that core's covers Cedar's. - Walk Cedar expressions with one visitor, and split policy analysis into per-action collectors. - Split cedar_only.rs into engine, routes, L7, destination, and test modules. - Name the Cedar policy check (`SandboxPolicy::is_cedar`) and the gateway and supervisor Cedar support checks. - Group argument lists in Cedar evaluation and provider-rule compilation into structs. - Import shared types from policy_types and policy_engine; keep the opa re-exports as transitional. - Document the policy engines in the supervisor-network README. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
/ok to test 12f73d0 |
`cargo check -p openshell-gateway` accepts features of the gateway's direct dependencies only, so openshell-prover/prebuilt-z3 failed the check. openshell-server/prebuilt-z3 enables the prover's. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
@johnnygreco, there was an error processing your request: See the following link for more information: https://docs.gha-runners.nvidia.com/cpr/e/2/ |
|
/ok to test 203d660 |
- Restore main's POSIX socket path in the isolation registration round-trip test; registration validates POSIX-absolute paths on every host, so a Windows temp path is rejected. - Run the shared host tests only on Unix, where hosted sandbox instances are supported. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
/ok to test 7f95f83 |
Summary
Implements RFC 0020 (#4564): a sandbox policy can be written in Cedar instead of YAML, chosen once per sandbox and enforced by Cedar alone. YAML sandboxes are unchanged. Draft while the RFC is under review; it is otherwise complete and verified.
Cedar comes from
ai-openshell/cedar, the project's own Cedar in the OpenShell CNCF workspace, pinned by commit. OpenShell iterates on policy-language features there with the Cedar team (delimitedliketoday, tracked upstream as cedar-policy/rfcs#115), and does not depend on those features reaching the upstream Cedar release.Related Issue
Closes #4411
Changes
openshell-policy-cedar-schemaandopenshell-policy-cedar: the canonical schema, strict validation, load-time analysis (Landlock grants, inspected endpoints and paths, policy DNS eligibility, native TCP, address ranges, binary aliases and globs, query keys), evaluation with audit and staged policies, and the token-grant compiler for provider rules.SandboxPolicyfieldscedar_policy_source,provider_credential_rules(gateway-managed), andendpoint_settings..cedarpolicies, the--middlewarefile (middleware, endpoint settings, process identity), one shared validation, format-switch rejection, and aPolicyEnginethat is OPA or Cedar; a Cedar sandbox builds no OPA engine and shares only typed Rust data with the YAML path.POLICY_FORMAT=cedarin their scripts; thee2e/cedarsuite and its CI matrix entry.docs/how-it-works/policies/cedar.mdx, the middleware configuration page, and the crate README.Testing
-D warnings,cargo deny,mise run pre-commit; unit tests on macOS and Linux; Windows cross-compile of the supervisor network crate; Go SDK CI)mise run e2e:cedar, 26 checks)Checklist
🤖 Generated with Claude Code